EUVD-2026-33303
GHSA-9392-pj54-qqf8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or log into AVideo account
-
DeliveryIdentify AuthorizeNet plugin enabled
-
ExploitPOST crafted amount to processPayment.json.php
-
ExecutionServer hardcodes paymentSuccess=true
-
PersistYPTWallet::addBalance credits attacker wallet
-
ImpactSpend or cash out fraudulent balance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Requires an authenticated AVideo user session (PR:L) and the target instance must have both the AuthorizeNet plugin and the YPTWallet plugin enabled, which exposes plugin/AuthorizeNet/processPayment.json.php and the addBalance() sink. No user interaction, no admin privileges, no special platform, and no non-default flag beyond enabling those two plugins are needed; the attacker simply submits a POST with an arbitrary amount parameter. Exploitation is limited to AVideo deployments that actually use Authorize.Net as a wallet top-up method - sites running other payment plugins or with wallet functionality disabled are not reachable through this code path. |
| Impact | CVSS 4.0 scores this 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N - network-reachable, low complexity, low privileges (authenticated user), no user interaction, and a high integrity impact with no confidentiality or availability effect, which accurately reflects a financial-integrity bug rather than a system-takeover. No EPSS, KEV, or SSVC data was supplied, and no public exploit is identified at this time, so this is not currently a mass-exploitation priority. However, the bar to exploit is extremely low for any operator that runs both the AuthorizeNet and YPTWallet plugins: a single authenticated POST forges wallet credit, which translates directly to monetary fraud and potential downstream abuse of any feature that consumes wallet balance. The PR:L requirement and plugin-dependency limit blast radius to deployments that actually expose registration plus these two plugins. |
| Exploit ScenarioDerived | An attacker registers a normal user account on a target AVideo site running the AuthorizeNet and YPTWallet plugins, then sends an authenticated POST to plugin/AuthorizeNet/processPayment.json.php with an inflated amount field. The server skips the unimplemented Authorize.Net charge, treats $paymentSuccess as true, and YPTWallet::addBalance() credits the attacker's wallet, which can then be spent on paid content, withdrawn, or used to defraud the operator. No public exploit is identified at time of analysis, but the flaw is trivially reproducible with curl given a session cookie. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.
RemediationAI
No vendor-released patched version was identified at time of analysis; consult GHSA-9392-pj54-qqf8 at https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8 for the upstream fix status and upgrade once a tagged release supersedes 29.0. As an immediate compensating control, disable the AuthorizeNet plugin in the AVideo admin panel (which removes the vulnerable endpoint entirely at the cost of losing Authorize.Net as a payment method), or disable the YPTWallet plugin so addBalance() cannot be reached (which breaks any stored-balance features). If neither plugin can be turned off, block external access to plugin/AuthorizeNet/processPayment.json.php at the web server or WAF, restrict it to known internal callers, and audit YPTWallet transaction logs and wallet balances for unexpected credits since the plugins were enabled; locally patch processPayment.json.php to remove the hardcoded $paymentSuccess = true and reject requests that lack a server-verified Authorize.Net transaction ID.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WWBN AVideo is an open-source PHP-based video platform (CPE cpe:2.3:a:wwbn:avideo) that supports a plugin ecosystem including the AuthorizeNet payment integration and the YPTWallet stored-balance system. The vulnerability sits in plugin/AuthorizeNet/processPayment.json.php, where the developer left a TODO placeholder for the real Authorize.Net charge logic and instead hardcoded $paymentSuccess = true before invoking YPTWallet::addBalance() with the client-supplied amount parameter. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the server treats an attacker-controlled HTTP POST value as proof of payment without verifying any transaction ID, webhook signature, hosted payment token, nonce, or server-side payment record against Authorize.Net.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.
Executive ViewAI
WWBN AVideo 29.0 and earlier contains a wallet balance forgery vulnerability allowing any authenticated user to credit their account with arbitrary funds by bypassing payment validation, creating direct revenue leakage and enabling insider fraud across all content monetization operations. Organizations using AVideo for paid content or creator payouts face immediate financial loss through unauthorized wallet credits that cannot be reversed without manual forensics. This vulnerability has no available vendor patch, requiring urgent operational controls to prevent exploitation.
Block access to /plugin/AuthorizeNet/processPayment.json.php endpoint via WAF or reverse proxy rule. Implement real-time anomaly detection on wallet transactions to flag additions inconsistent with Authorize.Net settlement logs. Restrict all wallet credit operations to administrator approval; require multi-factor authentication on any balance adjustment. Perform daily reconciliation: cross-reference Authorize.Net transaction records against AVideo wallet credits to identify unmatched transactions. Disable user-accessible payment methods pending patch; temporarily switch to manual payment processing and creator payouts. Monitor Authorize.Net merchant dashboard for any processing attempts from the affected endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB